Initial code commit for cfn-lint

.gitignore

@@ -0,0 +1,104 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+.static_storage/
+.media/
+local_settings.py
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# pyenv
+.python-version
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/

CHANGELOG.md

@@ -0,0 +1,19 @@
+### Roadmap
+- Be able to test transforms (serverless, include)
+- Add tests around common resource types
+  - AutoScaling
+  - Ec2 Instances
+  - Load Balancers
+  - RDS
+- Create a framework to test ARNs
+- Test Ref resources to IAM Roles have good assume role documents.  Example: Lambda Function Ref refers to an IAM Role that can be assume by Lambda.
+- More Warnings around hard coded values (Regions, AccountIds) to help with the practice of reusability
+
+### 0.1.0
+###### Features
+- Testing CloudFormation resources against the Resource Spec
+- Test Functions against supported included functions
+- Test overall CloudFormation structure
+- Test Regionalization of a template against the Resource Spec
+- Ability to add additional rules on parameter
+- In depth checks of values around AWS::EC2::VPC, AWS::EC2::Subnet, and AWS::EC2::SecurityGroup

MANIFEST.in

@@ -0,0 +1 @@
+include lib/cfnlint/data/CloudFormationResourceSpecification.json

NOTICE

@@ -0,0 +1,2 @@
+cfn-flip
+Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved. 

README.md

@@ -1,7 +1,40 @@
-## CloudFormation Linter 
+# CloudFormation Linter
 
-CloudFormation Linter
+Python code to create a binary that can be used to lint check CloudFormation templates.  
 
-## License Summary
+### Warning
+This is an attempt to provide validation for CloudFormation templates properties and
+their values.  For values things can get pretty complicated (mappings, joins, splits,
+conditions, and nesting those functions inside each other) so its a best effort to
+validate those values but the promise is to not fail if we can't understand or translate
+all the things that could be going on.
 
-This sample code is made available under a modified MIT license. See the LICENSE file.
+## Install
+From a command prompt run `python setup.py clean --all` then `python setup.py install`
+
+## Parameters
+From a command prompt run `cfn-lint --template <path to yaml template>`
+optional arguments:
+* -h, --help - Show this help message and exit
+* --template TEMPLATE - CloudFormation Template
+* --format {quiet,parseable,json} - Output Format
+* --list-rules - List all the rules
+* --regions [REGIONS [REGIONS ...]] - List the regions to validate against.
+* --ignore-bad-template - Ignore failures with Bad template
+* --append-rules [RULESDIR [RULESDIR ...]] - Specify one or more rules directories using one or more --append-rules arguments.
+* --ignore-checks [IGNORE_CHECKS [IGNORE_CHECKS ...]] - Only check rules whose id do not match these values
+* --log-level {info,debug} - Log Level
+* --version - Version of cfn-lint
+
+## Examples
+### Basic usage
+```cfn-lint --template template.yaml```
+
+### Test a template based on multiple regions
+```cfn-lint --regions us-east-1 ap-south-1 --template template.yaml```
+
+> E3001 Invalid Type AWS::Batch::ComputeEnvironment for resource testBatch in ap-south-1
+
+
+## Credit
+Will Thames and ansible-lint at https://github.com/willthames/ansible-lint

examples/rules/PropertiesTagsIncluded.py

@@ -0,0 +1,63 @@
+"""
+  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy of this
+  software and associated documentation files (the "Software"), to deal in the Software
+  without restriction, including without limitation the rights to use, copy, modify,
+  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+"""
+from cfnlint import CloudFormationLintRule
+from cfnlint import RuleMatch
+import cfnlint.helpers
+
+
+class PropertiesTagsIncluded(CloudFormationLintRule):
+    """Check if Tags are included on supported resources"""
+    id = 'E9001'
+    shortdesc = 'Tags are included on resources that support it'
+    description = 'Check Tags for resources'
+    tags = ['base', 'resources', 'tags']
+
+    def get_resources_with_tags(self, region):
+        """Get resource types that support tags"""
+        resourcespecs = cfnlint.helpers.load_resources('/data/CloudSpecs/%s.json' % region)
+        resourcetypes = resourcespecs['ResourceTypes']
+
+        matches = list()
+        for resourcetype, resourceobj in resourcetypes.items():
+            propertiesobj = resourceobj.get('Properties')
+            if propertiesobj:
+                if 'Tags' in propertiesobj:
+                    matches.append(resourcetype)
+
+        return matches
+
+    def match(self, cfn):
+        """Check Tags for required keys"""
+
+        matches = list()
+
+        all_tags = cfn.search_deep_keys('Tags')
+        all_tags = [x for x in all_tags if x[0] == 'Resources']
+        resources_tags = self.get_resources_with_tags(cfn.regions[0])
+        resources = cfn.get_resources()
+        for resource_name, resource_obj in resources.items():
+            resource_type = resource_obj.get('Type', "")
+            resource_properties = resource_obj.get('Properties', {})
+            if resource_type in resources_tags:
+                if 'Tags' not in resource_properties:
+                    message = "Missing Tags Properties for {0}"
+                    matches.append(
+                        RuleMatch(
+                            ['Resources', resource_name, 'Properties'],
+                            message.format('/'.join(map(str, ['Resources', resource_name, 'Properties'])))))
+
+        return matches

examples/rules/PropertiesTagsRequired.py

@@ -0,0 +1,47 @@
+"""
+  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy of this
+  software and associated documentation files (the "Software"), to deal in the Software
+  without restriction, including without limitation the rights to use, copy, modify,
+  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+"""
+from cfnlint import CloudFormationLintRule
+from cfnlint import RuleMatch
+
+
+class PropertiesTagsRequired(CloudFormationLintRule):
+    """Check if Tags have required keys"""
+    id = 'E9000'
+    shortdesc = 'Tags have correct key values'
+    description = 'Check Tags for resources'
+    tags = ['base', 'resources', 'tags']
+
+    def match(self, cfn):
+        """Check Tags for required keys"""
+
+        matches = list()
+
+        required_tags = ['CostCenter', 'ApplicationName']
+
+        all_tags = cfn.search_deep_keys('Tags')
+        all_tags = [x for x in all_tags if x[0] == 'Resources']
+        for all_tag in all_tags:
+            all_keys = [d.get('Key') for d in all_tag[-1]]
+            for required_tag in required_tags:
+                if required_tag not in all_keys:
+                    message = "Missing Tag {0} at {1}"
+                    matches.append(
+                        RuleMatch(
+                            all_tag[:-1],
+                            message.format(required_tag, '/'.join(map(str, all_tag[:-1])))))
+
+        return matches

examples/templates/basic.yaml

@@ -0,0 +1,65 @@
+---
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  Basic Template
+Parameters:
+  ApplicationName:
+    Type: String
+    Description: Application Name
+  Environment:
+    Type: String
+    Default: Test
+    Description: Environment
+    AllowedValues:
+      - Dev
+      - Test
+  TestEnvironment:
+    Type: String
+    Default: String
+    Description: Another Environment
+    AllowedValues:
+      - Dev
+      - Test
+      - Prod
+  BillingContact:
+    Type: String
+    Default: [email protected]
+    AllowedPattern: '^[A-Za-z0-9._%+-][email protected]$'
+  OperationsContact:
+    Type: String
+    Default: [email protected]
+    AllowedPattern: '^[A-Za-z0-9._%+-][email protected]$'
+Conditions:
+  isProd:
+    Fn::Equals: [!Ref Environment, 'Prod']
+Resources:
+  untaggedInstance:
+    Type: AWS::EC2::Instance
+    Properties:
+      ImageId: ami-123456
+  myInstance:
+    Type: AWS::EC2::Instance
+    Properties:
+      ImageId: ami-123456
+      Tags:
+      -
+        Key: application
+        Value: !Ref ApplicationName
+      -
+        Key: environment
+        Value: !Ref Environment
+      -
+        Key: environment
+        Value: !If [isProd, 'Yes', !Ref Environment]
+      -
+        Key: environment
+        Value: !Ref TestEnvironment
+      -
+        Key: billing_contact
+        Value: !Ref BillingContact
+      -
+        Key: operations_contact
+        Value: !Ref OperationsContact
+      -
+        Key: security_contact
+        Value: [email protected]